drop evtx csvs · link logon service creation and remote execution events · reconstruct multi-hop chains · runs locally
evtx csvs
drop security + system evtx csvs
4624 in security · 7045 in system · 4698 in security — multiple hosts OK
drop security + system evtx csv exports (multiple files OK)